AVG 8.0 - Heads up

[Dymetrie]

AVG is my AV of choice, and I got passed this information from my e-mail administrator.

First of all I received this:

Grisoft acquired Exploit Prevention Labs and its Linkscanner, a tool that automatically scans search engine results before you click on them. If you search Google, for instance, and ten results turn up, it visits all ten links to ensure they're malware free.
Then, in late April, AVG rolled Linkscanner into its anti-virus engine, which has about 70 million active users worldwide. The company estimates that 20 million machines have upgraded to the tool's new incarnation, AVG version 8, and this has already cooked up enough ghost clicks to skew traffic not only on The Reg but any number of other sites as well."
The Linkscanner is a piece of garbage that slugs down browsing no matter what browser you use (if it even works with it),
You can turned it off in AVG 8. Sure it works to turn it off, but you are left with some stupid RED EXCLAMATION POINT over top of the AVG icon in the system tray like you did something really stupid!?! Huh?!?
Oh, and even OPEN DNS is having trouble with this unwarranted attack on their dns servers.

Obviously I asked more as this seemed to just be hearsay and rumour..

And received this in reply...

AVG & Linkscanner links:
http://forums.scotsnewsletter.com/index.php?showtopic=21068
http://incredibill.blogspot.com/2008/06/avg-8-linkscanner-fiasco-recap.html

Along with a fix :)

You can install AVG 8 with out the linkscanner:
* Download the AVG 8.0 Free Edition installation package from our website.
* Run the installation with the parameters /REMOVE_FEATURE fea_AVG_SafeSurf /REMOVE_FEATURE fea_AVG_SafeSearch. One way to achieve this is to:
o save the AVG Free installation file directly to disk C:\
o open menu Start -> Run
o type
c:\avg_free_stf_*.exe /REMOVE_FEATURE fea_AVG_SafeSurf /REMOVE_FEATURE fea_AVG_SafeSearch
* The installation will be started, and AVG will be installed without the LinkScanner component.

Just thought I'd headsup everyone here as I know a few people use AVG :)

[Davey_Pitch]

Thanks Dym, we put AVG on all our laptops in school, and I'd noticed that Linkscanner really slowing the net down (and sometimes killing it completely). :)

[Wossi]

We are supposed to be running AVG at work, only have it on the laptop though, the other 2 pcs are running avast. Will have words with the IT guy on Monday though to see if he knows about this.

[LeperousDust]

That is utterly rediculous though, what 'tard working for AVG thought that was a good idea!!?!

[Mondo]

An admin from another forum has posted this

As of Version 8, AVG has introduced a 'Link Scanner' - this software takes all of the links it finds and fires off requests via the internet to download these pages even if you're not going to visit them. It then scans the traffic and informs you if there are any risks. In theory, this is good, in practice and implementation it is actually very very bad and introduces some severe security issues.

The problems:

1. It's easy to detect if AVG is prefetching a page, this means that malicious sites can actually redirect the AVG requests to a clean page that contains no malware. As a result AVG will report that the page is safe and allow you to click through to it - when in fact all it saw was a dummy page and the real page could be infected with many many exploits

2. It wastes bandwidth for users - if you're on a limited bandwidth package, the last thing you want is your virus checker scanning pages that you have no intention of visiting.

3. It wastes bandwidth and creates fake DoS attacks on websites. I spent a number of days trying to track down the cause of server issues on CD Times - finally with Kryten's help we managed to determine that it was AVG creating what amounts to a DoS attack from multiple zombie machines. The software had hit upon a custom 404 page and in the period of 1 month I have had millions of requests - hundreds of thousands per day - for a page that doesn't even exist. The frequency of these requests resulted in the server becoming unstable and caused the site's monthly bandwidth use to increase by more than 20 times.

4. It ruins website statistics - with so many fake requests from computers that weren't going to visit a page in the first place, log file statistics are effectively useless. The impact of this is going to be felt widely for any site that appears in any search engine.

On top of this, as far as virus scanners go, my personal experience with AVG is that it cannot be relied upon to stop virus infections and there are far better products on the market. AVG 8 makes this situation even worse by introducing severe security risks associated with their badly implemented LinkScanner.

AVG's developers acknowledge that the situation isn't perfect, however they are going to continue pushing the deployment of LinkScanner. There are many viable options - the most sensible being to scan links as they are clicked with AVG acting as a proxy, however link pre-fetching ISN'T sensible. It is dangerous and should be immediately boycotted.

If software such as AVG, which is supposed to PROTECT you, introduces security risks use of it should be immediately discontinued. I would never touch the application with a barge pole - if there is as obvious a risk as this in the software, what sort of other holes might there be under the surface?

So now on any website statistic is useless, I've been on NOD32 for like 5 years now and even a free copy of kerspesky from barclays can't tempt me away from it.

[Daz]

Catching up with my Google Reader this morning and I read that they changed the thing to identify itself as IE6 to get around point 1. That introduces problems itself though of course.

http://www.theregister.co.uk/2008/06/26/avg_disguises_fake_traffic_as_ie6/

[Garp]

Another interesting bug noticed on my mothers laptop. After she installed AVG 8, it slowed the server down to an incredibly slow speed.

Eventually she asked me to look at it. Ran hdtach out of curiosity because even the Windows XP bootup screen was slow but the hard disk didn't sound busy / thrashed. HDTach reported she was getting a stunning 1.5Mb/sec MAX burst read.

Rolled back to the System Restore point before the one she installed AVG8, and back to 85Mb/sec.